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(Manuscript received December 28, 1978) 

The Traffic Service Position System (tsps) No. 1 operational soft- 
ware for Automated Coin Toll Service provides the logic which 
controls the handling of coin- originated calls served by the system. 
The partitioning of responsibilities between the Station Signaling 
and the Announcement Subsystem (ssas) are illustrated. The main- 
tenance philosophy, fault detection, diagnostics, and fault recovery 
aspects of the ssas are described. The maintenance strategy is cen- 
tered on a multilevel fault detection scheme in which faults are 
analyzed and classified according to their degree of seriousness in 
affecting the ssas operation. 

I. OPERATIONAL SOFTWARE 

Automated Coin Toll Service (acts) is a feature of the Traffic 
Service Position System. 1 A Station Signaling and Announcement 
Subsystem (ssas) has been added to tsps to detect and process coin 
deposits and to construct announcements for coin sent-paid toll cus- 
tomers. 

The ssas contains a programmable controller (a microprocessor), 
which has a Read Only Memory (rom) for program and a Random 
Access Memory (ram) for transient data. It also has a set of Coin 
Detection and Announcement circuits (cdas). These circuits detect 
coin deposit signals from coin stations and decode digital speech 
phrases to produce analog announcements. The ssas also has an 
Announcement Source and Distributor (asd) which contains an an- 
nouncement memory with digitally encoded speech phrases (see Fig. 
1). Commands to the ssas are sent by the TSPS processor over the 
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Fig. 1 — ssas configuration. 

Peripheral Unit Address Bus (puab). Replies to the tsps processor are 
sent over the Scan Answer Bus (scab). 

1.2 Functional description of ACTS call processing 
1.2.1 Initial call setup 

When the tsps call connections program* receives a report of an 
incoming trunk seizuref from the supervisory scan program, it estab- 
lishes the required network connections for called digit and calling 
digit reception. (The latter is for Automatic Number Identification 
[ani] offices.) 

The ani digit analysis program assumes control until reception of 
the calling party's number is completed. 



* This program runs on the tsps main processor. 

t The description that follows deals only with calls that originate on trunks on the 
base network. Calls that originate on the network of an rta are also handled by the 
operational software but not described below. 
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When the calling party identification has been received, control is 
returned again to the call connection program. At this time, a general 
analysis is performed on the information obtained, and the call is 
marked as 0+, 1+, etc. The 1+ coin- originated calls are candidates for 
automated treatment. (Coin customers expecting to make deposits to 
pay for a station-to-station call will dial the call with a "1" prefix or no 
prefix.) 

1.2.1.1 Initial ACTS processing. The next step in processing the 
call is to determine whether the call can be automated. This is done 
by a program in the main tsps processor. 

Conditions for Automation. 1+ calls that satisfy the following cri- 
teria are candidates for automation during the initial contact on the 
call. 

(i) ACTS-Converted Trunk Group. The call must be on an acts- 
converted trunk group. Certain modifications are needed in the 
coin station to generate dual-frequency coin deposit tones 
which the Coin Detection and Announcement circuits can 
recognize. All coin stations served by a trunk group must be 
modified before any calls on that trunk group can be automated. 
(ii) Machine Ratable. The call must be machine-ratable; i.e., tsps 
must receive or have in office data sufficient rating information 
to calculate the charges due on a call. 

(Hi) Not a Postpay Coin Originating Station. The call must not be 
from a postpay station. Coins deposited at postpay coin stations 
cannot be returned. An operator must verify that the correct 
party or station has been reached before the customer makes 
any deposit. 

(iv) Not a Large Charge Call. The call must have an initial charge 
less than a certain threshold. Coin station hoppers handle only 
limited numbers of coins (24 nickels, for example). Operating 
practices instruct operators to make partial collections for every 
two to three dollars deposited if the call has large charges. 
Large charge calls require multiple collections. Hence, an op- 
erator is required to verify called party answer before any coins 
are collected. 
(u) Automatic Number Identification. The call must have success- 
ful Automatic Number Identification. If an ani failure occurs 
or the call is Operator Number Identified (oni), the call cannot 
be rated. An operator must key the calling number. 

Coin deposit monitoring on calls that fail condition (i) is not auto- 
mated but is handled by operators using current procedures. However, 
notification at the end of the initial period can be automated on all 
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coin calls, even if dual-frequency oscillators are not installed in the 
coin stations. 

Calls that fail conditions (ii), (Hi), or (iv), as well as person-paid, 
coin-originated calls (which are dialed as 0+ calls), seize a position for 
the required operator assistance. If the trunk group is ACTS-converted, 
a Coin Detection and Announcement circuit is attached to assist the 
operator in counting deposits. Subsequent deposit monitoring for 
overtime can be fully automated unless the large charge threshold is 
exceeded. 

Calls that fail only condition {v) seize a position for the purpose of 
acquiring the calling number. After the number is keyed in by the 
operator, further handling of the call is automated. 

If the above conditions for automation are met, the call connections 
program seizes an idle Peripheral Order Buffer (pob) and transfers 
control to the network control program which loads the pob with 
orders to establish a connection between the calling customer and a 
Coin Detection and Announcement circuit. If a cda is not available, 
the call connections program seizes an idle pob and transfers control 
to the network control program which loads the pob with orders to 
establish a connection to both a position and an outpulsing circuit. 
The call is subsequently handled as a non-ACTS coin call. 

ssas Processing of Initial Deposit Requests. Processing in the ssas 
begins when the Programmable Controller (procon) receives an initial 
deposit request command from the tsps processor. The command is 
read by procon from the ssas input registers. The command message 
includes the number of the cda handling the call, the initial duration 
of the call, and the amount to be requested from the customer (see 
Fig. 2). For purposes of illustration, assume the charge is $1.15 and the 
initial period is three minutes. 

The command field of the message is used as an index into a transfer 
table. The procon transfers to the address retrieved from the table. 
That program records the call data in the ssas data ram, sets the 
initial state indication for the call, and sends an output command to 
initialize the cda circuit. 

The procon next initiates scanning of the cda circuit for coin 
deposits. The procon will continue scanning the cda circuit at least 
once every 250 ms for the duration of the initial deposit phase of the 
call. The procon also instructs the ssas announcement control cir- 
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Fig, 2 — Typical ssas input message from tsps processor. Message is in format as sent 
from tsps processor (two 20-bit words). 
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cuitry to send the first segment of the appropriate announcement 
phrase to the cda circuit. It sends subsequent commands for successive 
portions of the announcement every 512 ms. The announcement used 
for the call being described is: 

"One dollar and fifteen cents,* please." (2-second pause) "Please 
deposit one dollar and fifteen cents* for the first three minutes." 

If the customer deposits during the announcement, the cda circuit 
instantly inhibits the announcement. When the procon scans the cda 
circuit and recognizes the deposit, it ceases sending further announce- 
ments, adds the value of the coin deposit to the previous amount 
deposited, and compares the total with the amount due. Assuming a 
sufficient deposit has not been made, the procon begins timing. If the 
customer fails to deposit within five or six seconds, a prompting 
announcement is provided indicating the amount still to be deposited. 
For example, if the customer deposits three quarters in the above 
example and then stops, the prompt is: 

"Please deposit forty cents more." 

If the initial deposit announcement completes without a deposit, 
timing will begin at that point. If the customer has made no deposits 
and a time-out occurs, the announcement wording for the prompt is: 

"Please deposit one dollar and fifteen cents." 

Each deposit made causes the procon to reset its software intercom 
timing register for the call. 

The procon will report the final results of the initial deposit request 
to the tsps processor by loading a message into the ssas output fifo 
buffer (see formats in Fig. 3). There are basically three situations 
possible. 

(i) If the customer has failed to deposit within five to six seconds 
after a prompt, the procon sends a reply (Fig. 3, format B) to 
the tsps processor indicating this fact so an operator can be 
connected to provide assistance. 
(ii) If the customer deposits the exact amount requested, the pro- 
con sends reply format A which contains the amount deposited. 
{Hi) If the customer overdeposits by using too large a denomination 
coin, the procon sends reply format A. (The tsps processor 



* The announcement format varies slightly, depending on whether the charge involves 
a dollar amount, a cents amount, or both. 
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Fig. 3 — Formats of ssas output fifo buffer. 

recognizes the overdeposit and records a credit towards over- 
time.) 

The procon acknowledges the latter two cases above by initiating 
announcements. If the exact amount is deposited, the announcement 
is: 

"Thank you." 

If an overdeposit has been made (for example, $1.25 on the $1.15 
call described above), the announcement is: 

"Thank you, you have ten cents credit towards overtime." 

The procon continues to scan the cda for further deposits until the 
acknowledging announcement is completed and sends a final deposit 
report to the tsps processor at the end of the announcement. (This 
ensures credit for a belated deposit.) Finally, the procon places the 
cda and the associated call memory in the ssas data ram in the idle 
state. The procon performs no further action on the cda until a new 
command is received from the tsps processor. 

At any time during the processing described above, the tsps proces- 
sor can send a special command which causes the procon to idle the 
cda circuit and associated call processing memory. (One example of 
this happening is if the customer hangs up.) 

Successful Initial Seizure. Upon receipt of the reply from ssas 
indicating an exact deposit or overdeposit, the call is processed to 
completion. The call connections program seizes an idle pob and 
transfers control to the network control program which loads the pob 
with orders to connect an outpulsing circuit. If an outpulsing circuit is 
not available, the call connections program queues until the circuit is 
available. The call connections program loads the orders to perform 
the appropriate relay operations required to complete the connection 
and activates the pob. Upon successful pob completion, control is 
returned to the call connections program where the pob is idled. The 
outpulser loading routine is called next. It loads the digits to be 
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outpulsed in an outpulsing register and activates sender-attached 
scanning for the receipt of a sender-attached signal from the toll office. 
Outpulsing of the called number to that toll office proceeds as described 
in Ref. 2, page 2658 ff. 

Receipt of called party answer and call timing also follow the 
description in Ref. 2. 

Operator Assistance on Automated Initial Seizure. If the customer 
fails to deposit in response to prompting by the ssas or flashes the 
switchhook* to acquire operator assistance, the customer will be 
connected to an operator. This section discusses the display presented 
to the operator, the operator actions, and potential race conditions. 

If the call must queue for a position, it is given "recall priority" to 
minimize customer delay. The Coin Detection and Announcement 
circuit is connected to the calling customer during the queuing interval. 
If the call is being sent to a position because of a time-out and the 
customer subsequently satisfies or exceeds the charges while queuing 
for a position, the ssas informs the tsps processor, the call is removed 
from the position queue, and outpulsing is initiated without operator 
assistance. When the call reaches the position, the following keys and 
lamps on the operator console (see Fig. 4) are lit steadily. 

The loop access key (acs) 

The appropriate supervision lamps (cld), (clg) 

The station coin lamp (sta) 

The ama station-paid key (paid) 

The release forward key (fwd) 

The lighting of the ama station-paid key and the release forward 
key indicates to the operator that an acts time-out or a customer 
switchhook flash has occurred during an acts initial contact. 

In addition to the above, an acts underdeposit display is given to 
the operator (see Fig. 5). The "charge-minute" designation strip is lit 
steadily and the numeric field contains, from left to right, up to three 
digits for charges due, one digit for the initial period and up to three 
digits for the amount due. 

While the call is attached to a position, the operator assists the 
customer in making a full deposit. The operator must announce the 
amount due (the right-hand quantity) in the numeric field. The cda 
circuit monitors and counts the coin deposits. The numeric display is 
not automatically updated with each coin deposit. However, the op- 
erator can update the display by using the charge and minutes (chg- 



* For a time-out, the ssas indicates the request for an operator by a message. For a 
flash, the tsps processor initiates the request. 

ACTS SOFTWARE 1257 




CO 



fe 



1258 THE BELL SYSTEM TECHNICAL JOURNAL, JULY-AUGUST 1979 



ACTS - UNDER DEPOSIT 



AMOUNT DUE 



d a a is nn nan nasi 

(charge) (minutes) 



Fig. 5 — tsps No. 1 console numeric display. 

min) key. (The ssas will be interrogated for the current amount 
deposited and the appropriate display presented.) 

When the ssas recognizes that the deposit request is satisfied, the 
tsps processor is informed. The forward number is outpulsed and the 
correct display is presented to the operator (see Fig. 6). 

The operator receives several indications that the deposit is satisfied: 
outpulsing occurs, the amount due display changes to zero, the release 
forward key darkens, and the start key lights during outpulsing. 

After acknowledging the deposit, the operator depresses the start 
timing* and position release keys. 

At position release, the tsps processor requests the amount detected 
by the cda circuit. Upon receipt of the report, the cda circuit is 
disconnected from the call. This final report accounts for all money 
deposited (while the cda was connected to the call) so no late deposits 
are missed. 

If an overdeposit occurs, the numeric display is changed to an 
overdeposit display (see Fig. 7). This display has a flashing "charge- 
minutes" designation strip and a numeric display of zero in the charge 
field, blanks in the minutes field, and two digits having the overdeposit. 
The operator informs the customer that credit will be given towards 
subsequent overtime charges on the call, depress start timing, and 
position release. On subsequent deposit requests, the overdeposit is 
automatically subtracted from the charges due. 

1.2. 1.2 Coin notification. At the end of the initial period, coin sent- 
paid customers are notified. With acts, this no longer requires an 
operator. The description below applies to coin sent- paid calls from 
both acts and non-ACTS converted stations. 

tsps Processing of Coin Notification. When a call reaches the 
talking state, it is under the control of the disconnect program. The 
call is placed on a timing list when the called answer has been 
established. A time-out occurs 7 seconds prior to the end of the initial 
period. Subsequent to this time-out, a coin collect sequence! occurs 



* Timing on the call is initiated by the tsps processor only if the called customer 
answers. 

t The coin collect sequence does not occur on postpay coin stations. 
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Fig. 7 — tsps No. 1 console numeric display. 

and the call is returned to the timing list for the remainder of the 
initial period. 

At the end of the initial period, the disconnect program seizes an 
idle Peripheral Order Buffer (pob) and transfers control to the network 
control program which loads the pob with orders to establish a 
connection between the calling customer and a Coin Detection and 
Announcement circuit. 

ssas Processing of Coin Notification. When the procon receives an 
input message requesting an end-of-initial-period notification on a coin 
call, the data accompanying this command are the cda number and 
the time of the initial period. In response to this command, the procon 
directs the ssas announcement control circuitry to give the following 
announcement: 

"Three minutes has ended, please signal when through." 

(A three-minute initial period is used for this illustration.) No coin 
scanning is performed, as no deposits are expected. After the announce- 
ment, the cda hardware and software are idled and an announcement 
complete reply code (Fig. 3, format B) is sent to the tsps processor. 

1.2. 1.3 Charges due seizures. The acts procedures for fully au- 
tomating overtime charges due seizures on coin-paid calls are presented 
in this section. 

Conditions for Automation. The ssas can fully automate overtime 
charges due seizures on coin-paid calls on an ACTS-converted trunk 
group even if the initial contact requires an operator. Since the call is 
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already rated, no rating or calling number identification (ani) restric- 
tions apply to overtime seizures. Furthermore, charges due seizures for 
postpay calls are handled in the same manner as calls from other coin 
stations. However, there is one additional restriction on charge due 
seizures. All previous deposit request seizures (either initial contact or 
charges due) must have been successfully monitored by a cda circuit. 
Successful monitoring implies that cda circuit blocking did not occur 
and that the cda circuit did not malfunction. This condition ensures 
that overdeposit credits are not lost. (If a seizure is not monitored 
successfully and an overdeposit occurs, the credit is not recorded.) If 
successful monitoring does not occur, the call is processed by an 
operator using current practices. In summary, the conditions for au- 
tomating overtime charge due seizures are: 

(i) The calling station is on an ACTS-converted trunk group. 
{ii) The charges do not exceed the large charge threshold* (see 

Section 1.2.1.1). 
{Hi) All previous seizures were successfully monitored. 
{iv) cda must be available. 

If a call continues for a certain number of overtime intervals (usually 
10) and all the conditions for automation are satisfied, the ssas 
automates the changes in seizure. Additional intermediate deposits are 
requested at successive specified overtime intervals until the call 
terminates. Then the ssas automates the final charges due seizure at 
the end of the call. The collection sequences for end-of-call deposits 
and intermediate deposits are essentially the same. Furthermore, these 
collection sequences are very similar to those used for the initial 
contact on station (1+) calls (Section 1.2.1). 

With only a momentary interruption to the conversation path, tsps 
connects an idle cda circuit to the call, tsps informs the ssas of the 
amount due, the number of minutes which have elapsed, the cda 
circuit being used, and that it is a charge due seizure. 

ssas Processing of Overtime Deposits, ssas deals with the two 
overtime situations (end of call and intermediate overtime deposits) in 
a similar fashion. After receiving the command from the tsps proces- 
sor, the procon processes the call in a fashion similar to the initial 
deposit case and the reports returned to tsps are also similar. However, 
the tsps sends the amount of credit from previous deposits (if any) 
and the time sent is the elapsed overtime talked (in minutes), not the 
initial period. The announcement wording is also different. Assume 
that the call has progressed for five 25-cent overtime periods of two 



* The office data provided for the initial-period large-charge threshold is also used to 
specify the overtime large-charge threshold. 
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minutes duration each and that the customer had no credit. The 
announcement would be as follows: 

(Alerting tone) "Please deposit one dollar and twenty-five cents." 
(0.5-second pause) "One dollar and twenty-five cents for the past 
ten minutes." 

If the customer had a ten-cent credit, for example, the announcement 
is altered. 

(Alerting tone) "One dollar and fifteen cents please." (2-second 
pause) "You have ten cents credit. Please deposit one dollar and 
fifteen cents more for the past ten minutes." 

In the intermediate overtime deposit case, both customers are on 
the call and intend to continue talking. They both can hear the 
announcement and talk during the deposit interval. In the end-of-call 
overtime case, only the calling customer is on the call. 

As with the initial deposit situation, if a customer stops depositing 
coins, a prompting announcement is given. Failure to respond to this 
announcement results in a report to tsps requesting an operator. 

Operator Assistance. If the call times out or the customer flashes 
the coin station switchhook during the charges due phase of a call, an 
operator is connected to the call. The following keys and lamps on the 
operator's console are lit steadily: 

(i) The loop access key (acs). 
(ii) The appropriate supervision lamps (clg, cld). 
(Hi) The appropriate coin lamp (sta, 0+, or Dial 0). 
(iv) The appropriate ama key (station paid or person paid). 
(v) The charges due (chg-due) lamp. 

These are the same keys and lamps lit by tsps on charges due 
seizures prior to acts. In addition to these keys and lamps, the acts 
underdeposit display, previously described for initial contact, is lit on 
the operator's console. The appearance of the acts underdeposit 
display indicates two things to the operator. First, a cda circuit is 
attached to the call to monitor the deposits. Second, if the customer 
overdeposited on a previous seizure, the charges displayed have been 
corrected by the amount of credit. (Note that, on non-ACTS charge due 
seizures, the operator must subtract any credit claimed by the cus- 
tomer from the charges displayed.) 

The operator assists the customer until a full deposit is received. 
When the ssas recognizes that the deposit request is satisfied, the 
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correct deposit display is given. The operator thanks the customer and 
depresses position release. Upon releasing the position, tsps requests 
the amount detected by the cda circuit. After tsps receives this 
information from the ssas, the cda circuit is disconnected. 

If the customer overdeposits during an overtime collection with an 
operator attached, the overdeposit display is lit on the operator's 
console. If this is a charges due seizure for intermediate collections, 
the operator should inform the customer that credit will be given on 
subsequent overtime charges. If the overdeposit occurs at the end of 
the call, the operator should handle the disposition of the overdeposit 
in accordance with current operator practices. 

If the calling customer hangs up during the acts charge due an- 
nouncement sequence, or the calling customer leaves the phone off- 
hook, the operator should try to reach the calling customer, if neces- 
sary, by ringing back against off-hook. The operator may need to wait 
for the customer to return. If the operator is unable to obtain full 
payment for the call, the operator keys a walkaway trouble number. A 
traffic counter is pegged, and a special bit and the amount of shortage 
is recorded on the ama tape. 

Even after the decision is made to go to an operator, the cda circuit 
still monitors coin deposits. If the deposit is satisfied before the 
Peripheral Order Buffer (pob) which connects the position is activated, 
the position seizure is aborted. The ssas acknowledges the deposit, 
and the call is released. 

If the position is seized and then the deposit is satisfied, the ssas 
does not acknowledge the deposit. When the operator's numeric dis- 
play is lit, it shows (or may quickly change to show) that the deposit 
is satisfied. The operator should acknowledge the deposit and release 
the call. 

1.2.2 Non-coin features 

The announcement without coin detection mode of operation is used 
to provide announcements for time and charges quotations and noti- 
fication on calls other than coin sent paid. A different command is 
used in each case to select a different announcement. 

1.2.3 SSAS as a coin detector 

The procon is also programmed to provide a mode of operation in 
which it gives no announcements but does monitor for coin deposits. 
This is used on operator-handled acts calls. In this mode, the procon 
informs the tsps processor when the required deposit or an overdeposit 
has been made. If the operator collects or returns coins while a call is 
in this state, tsps informs the ssas so the procon can appropriately 
update the amount deposited and the amount due in its data ram. If 
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the operator requests that the amount deposited be displayed, the 
ssas will transmit that amount to the tsps processor in response to 
the appropriate command. 

1.2.4 Coin station maintenance and administrative features 

One unique aspect of acts operation is that inband signals (the coin 
deposit tones) are transmitted directly from the station through to the 
tsps over the voice path. Two special features were developed that are 
related to coin tone signaling. First, a coin station test capability was 
developed which allows a craftsperson at the station to test that coin 
deposits for that station can be detected at the tsps. Second, a 
precutover mode of operation was devised to help detect stations that 
have not been converted to be compatible with acts. These features 
are described below. 

Coin station test call. After the craftsperson has performed the 
usual coin station tests, the tsps is accessed by dialing a special test 
code. When tsps receives this number, it connects the call to an idle 
cda and sends a message to the ssas with a command code indicating 
that this is a station test call. The remainder of the call is handled by 
the ssas except that tsps supervises the call. If the craftsperson goes 
on-hook, the tsps aborts the call by sending a command to ssas. Also, 
tsps will return coins on request from the ssas. 

When the procon receives the station test call command, it initial- 
izes the cda, begins coin scanning, and initiates the following an- 
nouncement: 

"Coin Test." (1-second pause) "Please deposit nickel." 

If the craftsperson deposits a nickel, the announcement, 

"Nickel" 

is given, acknowledging the deposit. A dime and quarter deposit are 
also requested and acknowledged. Then, the craftsperson may make 
additional deposits which will be acknowledged if received correctly. 
If no coin is deposited for about six seconds, the deposit request is 
repeated. If the wrong coin is deposited, a coin return is requested by 
the procon and the test is repeated. If repeated requests for deposits 
are not satisfied or a total of two minutes elapses on the call, the 
procon issues instructions for the announcement. 

"Test has ended." 

and reports the time-out to the tsps, which gives a coin return and 
disconnects the call. 
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1.3 P ROC ON program design 

The procon has relatively high processing capacity. It has a rela- 
tively powerful instruction set which is largely at the assembly lan- 
guage level rather than the microprogramming level, and it manipu- 
lates a 16-bit word. It uses a paged program memory and can execute 
instructions within a page in arbitrary, fixed order. (The next inter- 
page address (displacement) is specified in each 24-bit instruction.) 
Because of this characteristic, care must be exercised in relocating 
code to avoid improperly crossing a page boundary. (Such errors are 
detected during compilation.) 

The procon's 16K program memory limit requires that the pro- 
grams be very compact. While an attempt was made to use modern, 
structured, design and documentation techniques, the limited memory 
size caused compromises in some areas. (The ssas application requires 
a far larger program than most procon applications.) 

Multiprogramming was achieved by storing all call- (process) related 
information in the data ram. Each program retrieves all data from 
that memory when it begins processing a new call. Each program is a 
pure process stored in ROM (i.e., the program contains no variable data 
and cannot alter itself). 

The procon has very extensive self-checking features. In addition 
to a variety of parity checks (including next address parity), the 
arithmetic and logic circuits are duplicated and checked by matching. 

1.3.1 PROCON program administration and design standards 

Several designers developed separate programs which were inte- 
grated into one large program. Loading was accomplished by using a 
linkage editor and a common file of symbols and macros. All symbols 
(except labels) and all macros were defined in the common file. No 
numerical references were permitted, and input/output control desig- 
nation symbols were keyed to the circuit drawing names for the same 
leads. Thorough prologue comments were required for each routine. 
Standard labels and standard symbolic designations and usage for all 
procon internal registers were agreed upon by all programmers. 

1.3.2 PROCON active monitor 

The basic program loop for the procon in the active ssas (i.e., the 
ssas which is processing calls) is called the active monitor. The procon 
executes this program while looking for tasks to perform. In this loop, 
the procon first makes some maintenance checks and then reads a 
clock to determine if a new 512-ms period has begun. The 512-ms 
interval is called a base period. Its length is keyed to the length of an 
announcement speech segment. If a new base period has begun, a 
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special flag is marked in the system status register.* The procon then 
scans for a message from the tsps processor. If such a message has 
arrived, it records the data in the appropriate ram area. 

The procon then begins a loop in which each cda is processed. 
Each cda has a dedicated eight-word call register associated with it. 
(Figure 8 is a typical cda register layout.) First, the procon reads the 
address of the program which should process the call. This address, 
which also defines the state of the call, is called a Progress Mark (pm). 
If the pm is zero, the cda is idle or unequipped, so no action is taken. 
A typical pm program is the program which scans a cda for coins. The 
pm is stored as a page number and a displacement within the page. 
The active monitor transfers to the pm routine. If the pm routine 
determines that the call requires timing, it checks the new base period 
flag. If that flag is set, the required timing counter is updated. 

When the pm program returns to the active monitor, the monitor 
checks the new base period flag. If that flag is set, all timing counters 
for the cda are updated as required and a new announcement segment 
is selected. (The announcement processing is described in Section 
1.3.4.) After the announcement program is completed, the monitor 
processes the next cda. When all cdas have been processed, the 
monitor clears the new base period bit, checks for various maintenance 
tasks, and then begins the main loop again. 

1.3.3 Announcement store layout 

Each announcement speech segment consists of 16,000 bits of digital 
data stored in 400 consecutive announcement store locations. Each 
location contains 40 bits of data. Decoded at a 31,250 bits/second rate, 
this corresponds to 512 ms of speech. For programming ease and 
circuit design convenience, all segments must begin at an address 
which is a multiple of 16. Most words used fit in one segment (for 
example, the numbers "one" to "ten"). However, several words or 
phrases require two segments (for example, the word "eleven" or the 
phrase "please deposit"). A few phrases require three segments (for 
example, the phrase "please signal when through"). 

Because the announcement circuitry bit-synchronizes segments, two 
or more segments can be blended together with no loss in quality. 
Therefore, words can be split between 512-ms segments to achieve the 
best cadence of speech. 

Successive segments constituting 1 -second and 1.5-second phrases 
need not occupy consecutive announcement store addresses. However, 
these segments generally must be used together. In contrast, suffix 
segments used for compound numbers may be combined with a variety 



* One of the procon general registers was reserved for critical status indicators. 
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of other segments. For example, the suffix "-teen" can be combined 
with the syllables "thir-," "four-," etc. to form the numbers "thirteen," 
"fourteen," etc. with minimal use of memory. Similarly, the units place 
suffixes "-one," "-two," etc. can be combined with the numbers 
"twenty," "thirty," etc. to form the full required set of numbers (e.g., 
twenty-one, twenty- two, thirty-one, thirty-two). 

Several words are duplicated in the announcement store so that 
both neutral and falling inflections are available. The falling inflections 
are used only at the ends of sentences, while the neutral inflections are 
used elsewhere. 

In total, about 80 speech segments 512 ms in length are required for 
acts call handling. About 15 more are required for maintenance 
purposes. 

1.3.4 Announcement table structures 

Two major announcement tables are stored in the procon rom. The 
first is simply a table of addresses. Reading this table using the speech 
segment number as an index provides the address of the first an- 
nouncement store location containing the data for that speech seg- 
ment. 

The second table is more complex, as it controls the sequencing of 
announcement segments to form sentences. The logic for this process 
is embedded largely in this table rather than the program code. This 
makes debugging easier and also simplifies the process of adding new 
announcements. The table consists of program addresses for general- 
ized routines dealing with each step of the announcement. The address 
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of the current table entry is stored in the second word of the cda 
register (see Figure 8). Each announcement routine must decide what 
speech segment is to be reproduced next and also update the table 
address in the cda register. The major situations the various routines 
must deal with are demonstrated by the following example. 

The structure of a portion of a typical announcement is represented 
schematically in Fig. 9. This is the end of the time-and-charges 
announcement used for noncoin calls. A typical example of this an- 
nouncement follows. 

"The charges are one dollar and twenty cents plus tax for seven 
minutes." 

The three major types of announcement routines are each involved 
in this announcement. One type of routine simply sequences speech 
segments in fixed order (for example, the words "plus tax for"). The 
second type of routine chooses a word or sequence of words ("one 
minute" versus "M minutes") based on the value of a parameter 
(whether M is one or greater than one). The third type of routine 
translates a parameter (M) into a speech segment (for example, the 
number "seven") or a series of segments (for example, "twenty-one"). 
This last program is a subroutine since the action to assemble the 
number is the same whether it represents a dollar amount, a cents 
amount, or a time period. 



II. MAINTENANCE 
2.1 Overview 
2.1.1 TSPS maintenance requirements 

In tsps, as in other Bell System electronic switching systems, the 
maintenance strategy is based on duplicating vital hardware units 3 and 
providing hardware checking circuits for other units, using signals to 
indicate the successful execution of orders and using programs to test 
the state of the hardware, to detect faults, and to diagnose trouble. 

tsps provides fault recognition and diagnostic programs for all major 
circuit elements. The purpose of the fault recognition programs is to 
quickly detect faulty equipment units and, if necessary, remove them 
from service. Hardware checking circuits are used for trouble detection 



PLUS TAX FOR 



ONE 



MINUTE 



MINUTES 



Fig. 9 — Typical portion of an announcement phrase. 
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during operation. When a trouble detection circuit identifies a serious 
problem in the system, it notifies an interrupt circuit. The interrupt 
circuit immediately stops operational program processing and transfers 
control to a fault recognition program associated with the particular 
trouble indication. The functions of the fault recognition programs are 
to distinguish nonrepeating troubles (errors) from repeating troubles 
(faults), and, in the case of faults, to quickly establish an operational 
system configuration. This is generally done by switching out the 
faulty unit. When the fault recognition process is completed, opera- 
tional program processing is resumed at the point of interruption. 

Fault recognition is the highest priority function in a real-time 
system like tsps. It is of the utmost importance to high system 
reliability that minimum time be taken away from the operational 
processing functions because of faulty circuits. 

Once the faulty circuit has been taken out of service by the fault 
recognition program and the system brought back to an operational 
configuration, diagnostic programs are called in to test the out-of- 
service unit to isolate the trouble to a small number of circuit packs. 
A diagnostic program is normally broken into logic testing entities 
called subphases or phases so that a series of rigorous tests can be 
performed on the out-of-service circuit unit. Depending on the outcome 
(pass-fail) of each test, a trouble-locating number is printed on the 
maintenance teletypewriter. This trouble-locating number is used by 
the maintenance personnel to reference a trouble-locating manual to 
isolate the particular fault involved. 

2. 1.2 SSAS maintenance requirements and anticipated reliability 

ssas reliability and maintainability objectives are based on the fact 
that a significant part of tsps traffic is served by the ssas. The 
objectives are 

(i) An average of about one ssas outage in 10 years. 
(ii) An average repair time of about 2 hours. 

The maintenance plan for ssas impacts on the reliability objective 
in three major areas. First, it is necessary to provide fault detection 
mechanisms (primarily hardware checks) so all failures can be detected 
rapidly. Second, provisions must be made to minimize the interruption 
of call processing once a failure is detected, with few or no calls lost. 
Third, sufficient circuitry must be provided to obtain diagnostic reso- 
lution to hold repair time to the 2-hour average as specified above. 

The ssas maintenance strategy relies on a multilevel fault detection 
scheme in which faults are classified according to their impact on the 
ssas operation. A fault that does not affect normal operation of the 
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ssas is considered "tolerable." An ssas side with this type of fault may 
continue to perform its normal function adequately as long as it is 
required to do so. As an example, all single bit failures in the ssas 
semiconductor announcement memory are tolerated, since they would 
have very little effect upon the quality of the speech. By using a 
maintenance strategy that permits an ssas side to be used with certain 
"tolerable" faults, the ssas reliability is further enhanced. 

To verify that the ssas design meets the reliability objectives, a 
reliability estimate was made by classifying and counting the boards 
on the ssas side. The failure rate for each board type was calculated. 
The failure rate determines the Mean Time Between Failure (mtbf) 
of an unduplicated ssas side. The Estimated Downtime (edt) for the 
duplicated system was then calculated with the assumption that the 
mean time to repair for one side down and both sides down are 
identical. This is a valid assumption because the diagnosis of all critical 
circuits in ssas can be done on each side independently. Plugging 
necessary parameters into the appropriate reliability model showed 
that the above reliability objectives are well satisfied. 

2.2 Announcement Store Maintenance 
2.2. 1 SPC bus and store switch 

The Stored Program Control No. 1A (spc 1A) is the tsps main 
processor. 4 The spc memory is used for both programs and data. It is 
partitioned into a maximum of 24 duplicated stores. Each store is 
permanently assigned to one of the two spc store buses. An spc store 
can be equipped with a piggyback twistor (pbt) or semiconductor 
memory. Two sequential or complimentary name codes are assigned 
for an spc store when equipped with semiconductor memory and one 
name code when equipped with pbt. The name code serves to identify 
the stores for addressing purposes. A semiconductor store consists of 
a semiconductor memory module and its associated semiconductor 
memory controller, shared by all modules in the same memory frame. 
The spc store is the maintainable unit of spc memory; i.e., it can be 
removed from or restored to service, diagnosed, and updated with the 
contents of its duplicate. 

The ssas announcement memory is used to store digitized announce- 
ments. An Announcement Store Frame (asf) is permanently assigned 
to each side of each ssas. The ssas asf consists of an announcement 
memory controller and up to six announcement memory modules. To 
simplify development effort and to take advantage of the memory 
loading facilities and diagnostic software of the spc, the spc semicon- 
ductor store frame with a second access port is used as the announce- 
ment store frame. This is accomplished by placing a switch on the 
announcement memory which allows the memory to be connected to 
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either the ssas side or the spc store bus. Furthermore, to reserve the 
maximum number of memory name codes for the spc store, all spc 
memory access operations use odd parity name codes while all an- 
nouncement memory access operations use even parity name codes. 
Under the normal mode of operation, the switch is set to the ssas 
side so that access to the announcement memory can be performed. In 
the spc direct access mode, the switch is set to the spc side so that 
loading from the Program Tape Unit (ptu) and diagnosing by the spc 
can be accomplished. More discussion on loading and diagnostic op- 
erations is presented in a later section. 

2.2.2 The choice of announcement memory 

To handle all tsps station-paid coin call announcements as well as 
time and charge quotations for noncoin calls, it was calculated in 1974 
that announcement capacity equivalent to about 80 half-second words 
would be needed. An ultimate memory capacity of 200 to 400 half- 
second words was forecast at that time if vocabulary for future features 
as well as space for other tsps announcements were considered. 

A number of storage media were examined for the announcement 
memory. After some consideration, it was decided that with minor 
modifications the semiconductor memory used for the spc 1A store 
would also be suitable for the ssas announcement store. This choice 
of the announcement memory would provide flexibility in areas such 
as future vocabulary growth and vocabulary reload in the field from a 
magnetic tape. It was also estimated that most hardware and mainte- 
nance software designed for the spc 1A store could also be applied to 
the announcement store with only a modest amount of effort. 

2.2.3 Diagnostic implementation 

The spc store diagnostic programs were modified to be used for the 
ssas announcement store diagnostic. Major objectives for the an- 
nouncement store diagnostic implementation were specified as follows: 

(i) Circuits common to both designs to be tested by existing spc 

semiconductor memory diagnostic programs. 
(ii) New announcement store circuits to be tested by the ssas 

controller diagnostic. 
(Hi) Same Trouble Locating Manual (tlm) to be used for spc and 

ssas announcement stores. 
(iv) Similar tty input/output messages. 

Several diagnostic characteristics are common for the spc and 
announcement store diagnostic programs: the basic diagnostic unit is 
a controller and one memory module, seven diagnostic phases are in 
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the program, the diagnostic terminates on early detection of errors, 
there is a special bus configuration for increased fault detection, and 
finally, there are automatic exercise tests for all 32K words. For these 
common areas, existing spc store diagnostic programs were applied to 
the announcement store with only very modest modifications. 

On the other hand, some diagnostic characteristics pertaining only 
to the ssas announcement store must be added to the existing store 
diagnostic programs. First, the announcement store has to be switched 
onto the standby spc store bus before it can be diagnosed. Second, 
since during normal operations, the procon and asd circuits in the 
ssas controller control the operation of the announcement store, they 
must be stopped during spc diagnostic tests. Third, the ssas controller 
and memory modules use even parity names while the spc store uses 
odd parity names; consequently, diagnostic programs must be capable 
of distinguishing these two cases and proceeding accordingly. 

2.2.4 Loading store from program tape unit 

To save development effort, the spc program used to load from the 
Program Tape Unit (ptu), 4 compare with ptu tape, and dump the 
memory contents of the spc stores to a ptu tape is used to perform the 
same functions for the ssas announcement stores. However, since 
there are some significant differences regarding tape format, loading 
procedures, and priority levels between the spc stores and the an- 
nouncement stores, some changes were made in the ptu program to 
extend its capabilities. 

The requirements for the handling of the tape unit are as follows: 

(i) The announcement information should be separate from office 
data and generic programs. A separate tape containing only 
announcement data should be used for announcement stores. 

(ii) For the load operation, the craftsperson must force one spc bus 
active, simplex, before using the program to access the an- 
nouncement stores on the other bus. 

{Hi) The announcement tape header should be modified to distin- 
guish it from an spc tape. 

(iv) spc reliability should be given the highest priority. The an- 
nouncement store should not be accessed if the spc is not able 
to run full duplex with all stores operational. 
(v) Changes must be made to minimize spc downtime resulting 
from undetected ssas store faults. 

With these requirements in mind, the craftsperson is instructed not 
to use the program to access the announcement stores if the spc 
cannot run full duplex with all stores operational. With the spc fully 
operational, one bus may safely be forced active for the load operation, 
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thus placing the system in the simplex mode. This choice of which bus 
to force active must be made such that the standby spc bus will 
correspond to the ssas side requiring ptu actions. This procedure 
ensures that the announcement stores will never be placed on the 
active spc bus. Following this line of conservatism, the announcement 
stores are normally switched off the standby SPC bus and are connected 
just prior to a read or write instruction. After this instruction is 
completed, the stores are removed from the bus. 

The ssas side to be accessed must first be placed in the out-of- 
service or unavailable state for the compare or dump option. If the 
operation is to load an ssas announcement store with data from tape, 
the ssas side must be in the unavailable state. This state will not allow 
ssas side switching if a fault should be detected on the active side. 

2.3 SSAS fault recovery 
2.3. 1 PROCON detected and reported faults 

ssas fault recovery strategy is based on a fault detection scheme 
which uses both the spc and the programmable controller (procon) to 
detect various faults associated with the ssas hardware. Faults de- 
tected by procon are reported to spc. The decision to choose one 
method or the other was based on the following considerations. 

(i) ssas faults, particularly those with serious impacts on call 

processing, should be detected as quickly as possible. 
(ii) spc routine processing time required for detecting ssas faults 

should be kept as small as possible. 
(Hi) procon should not be responsible for detecting those faults 
which could affect its integrity or its ability to communicate 
with the spc. 

Those faults which are detected by procon are analyzed before 
being reported to spc. procon has the capability to analyze available 
data and reinterrogate appropriate maintenance registers. If failures 
are indicated, the result of analysis and reinterrogation are sent to the 
SPC. The reports sent by procon are analyzed by the spc and, if 
necessary, appropriate commands are sent to procon to prevent it 
from flooding the spc with unnecessary information. 

2.3.1.1 Continuous exercises. Continuous exercise of hardware 
by procon is a means of verifying the correct operation of the hardware 
and detecting various failures. Exercises are used both on active and 
standby ssas sides, but these are particularly important on the standby 
side since no call processing is taking place. (Call processing exercises 
the ssas rather completely.) 

The announcement subsystem' (i.e., the announcement store and 
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announcement distributor combined) is among those units which is 
continuously exercised by procon on both the active and standby 
sides to ensure the integrity of the speech heard by the customers. 
Any malfunction in these units would result in the appropriate flags 
being set in a maintenance register called the Error Summary Register 
(esr). This register is periodically scanned by procon, which analyzes 
the content and sends the appropriate information to spc. 

2.3. 1.2 Announcement subsystem failure reports, procon can 
recognize failures associated with the announcement subsystem by 
scanning the Error Summary Register (esr) periodically. The presence 
of any announcement subsystem failure will result in one or more flags 
being set in the esr. If the content of esr is different from its last look, 
procon sends a message to spc indicating what trouble has occurred, 
provided procon has received no commands from spc to stop sending 
information. 

During normal operation, a Hamming and parity check on the 
address and data received from the announcement stores is performed 
by hardware 5 before the data are sent on to the service circuits. Once 
an error is detected, an error flag will be set in the esr. The 67 bits of 
address, data, Hamming and parity for the error will be trapped in 
special maintenance address and data registers. 

The content of the esr is scanned periodically by procon. Upon 
identifying an announcement store error flag in the esr, procon saves 
the contents of trap registers. Then it performs a read using the saved 
announcement store failure address. Subsequently, it loads the fifo 
output register with the available information. This information in- 
cludes (see Fig. 10) the content of esr, the content of failure trap 
address and data registers (both original and retry values), and an 
extended reply code used to distinguish the cases where no error is 
detected upon retry from those where error is also detected upon retry. 

Upon receiving a procon report, spc analyzes the reported errors 
and decides whether a hard fault or a transient error is present. 
Detected errors and faults are categorized according to their types and 
seriousness. Types of errors and faults detected by spc are repeating 
double bit data fault, repeating single bit data fault, transient double 
bit data error, transient single bit data error, and repeating single bit 
address fault. The address and data associated with the errors and 
single bit data faults are also saved, and are printed hourly or upon 
manual request on the maintenance teletypewriter for manual trou- 
bleshooting. The failing address is also passed to the store diagnostic 
program to allow extensive tests of the suspected area of the memory. 

A feature that will aid in detecting announcement store errors is the 
announcement store recital program, which sequentially accesses every 
announcement phrase by loading its address into the maintenance 
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Fig. 10 — Format of announcement subsystem failure report. 

time slot of a Recirculating Shift Register (rsr). This type of routine 
exercise will guarantee that the memory used by every speech segment 
is accessed periodically. If any store error associated with a particular 
speech segment exists, a flag will be set in esr notifying procon of the 
error and the address and data associated with the errors will be 
trapped. This program is implemented on both active and standby 
ssas sides. 

2.3.1.3 Mate frame buffer failure reports. Communication be- 
tween the two ssas sides (see Fig. 11) takes place asynchronously 
through a first-in, first-out serial memory called the Mate Frame 
Buffer (mfb). Each transmission through the mfb usually consists of 
data and an id field which identifies the data. 

During normal operation, all the data associated with the calls in 
progress are sent from the active side to the standby side through the 
mfb. This operation enables the standby side to have an up-to-date 
copy in its Random Access Memory 5 (ram) of the data associated with 
each call for use if it is required to change role from standby to active. 
To test the validity of the data before it is stored, a l-out-of-16 encoded 
id word is associated with the data coming through mfb, to indicate 
what it contains. The standby procon checks for a valid id format 
and for proper sequences of ids. If the standby procon detects an 
error, it informs the spc by loading appropriate data in its fifo output 
register. 
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During the unloading of the mfb by the standby side, an overflow 
condition in the mfb results in an mfb full flag being set in the esr 
associated with the active side. This overflow condition could be 
caused by either an mfb failure or a failure in the standby side which 
prevents it from unloading the mfb. The mfb full flag in the esr is 
monitored by the active procon. Upon detecting the mfb full condi- 
tion, the active procon notifies spc by loading the necessary infor- 
mation in the fifo output register. 

2.3.1.4 CD A error reports. A cda failure is recognized by procon 
during normal interrogation. All calls except those that are in the 
announcement mode only require interrogating the cda reply register 
for coin deposits. Prior to sending the first interrogation command to 
a cda, procon reads the reply register to ensure that there are no 
premature replies from the cda. In the case of premature reply, all 
records of the call are erased and a message is sent to spc indicating a 
bad cda. During the course of interrogation, the parity of the data 
received from the cda is checked by procon. In the case of a parity 
failure, procon again erases the records of the call and informs the 
spc of the failure. 

During the course of interrogation, procon continuously monitors 
the format and the validity of the data in the CDA reply register. A 
reply with invalid format is considered a cda failure. In this case, the 
records of the call are also erased, and spc is notified of the cda failure. 
Another means of cda error detection is the CDA maintenance register. 
If a maintenance bit is set in the reply register, the maintenance 
register is read to check the type of error. In this case again, procon 
notifies spc and erases the records of the call. Upon receiving a cda 
error report from procon, spc routes the call to an operator position 
and also takes the bad cda out of service, so it is not used for any 
future call. A diagnostic automatically will be requested for the bad 
cda to aid the craftsperson in locating the faulty units. If too many 
cda failure reports are received within a certain period of time, all 
associated with the same group controller, spc then assumes that the 
group controller associated with the active side is faulty. 

procon can only detect failures in the digital circuitry of a cda. 
Failures in the analog circuitry of a cda are detected by an error 
analysis program which resides in spc. The success rate of attempted 
calls for a given cda is analyzed, and if it is below a certain average 
threshold, the cda is considered faulty and is taken out of service and 
automatically diagnosed. 

2.3.2 SPC detected and reported faults 

2.3.2. 1 Maintenance interrupts. Maintenance interrupts are used 
as a means of identifying faults in spc-ssas interface registers. These 
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types of faults have a serious impact on the operation of ssas. They 
can result in isolation of the ssas, thus crippling the capability of spc 
to determine the basic integrity of the ssas. This basic integrity is a 
necessary condition for the spc to have confidence in the capabilities 
associated with procon in detecting ssas faults. 

As with other tsps peripherals, any malfunction in spc-ssas com- 
munication is detected by using standard peripheral unit fault recog- 
nition techniques that can cause an F-level interrupt (such as central 
pulse distributor enable verify, and all-seems-well signal failures). 4 
Upon occurrence of an F-level interrupt, appropriate fault recognition 
programs are entered to analyze the faults present in spc-ssas interface 
areas. These programs have the capability of distinguishing serious 
faults from nonserious faults and reporting them to appropriate recon- 
figuration programs. 

During a scan operation of ssas by spc, a malfunction in one or both 
Scan Answer Buses (scab) results in an spc processor mismatch which 
in turn causes a C-level interrupt to occur. 4 Upon occurrence of a C- 
level interrupt, appropriate fault recognition programs are entered 
which first determine whether ssas caused the interrupt, and then by 
performing some tests isolate the faulty scab. The nature of failure 
and its degree of seriousness are also passed to ssas reconfiguration 
programs. 

2.3.2.2 Periodic scans, spc detects faults in procon itself or in the 
procon peripheral control system by interrogating maintenance reg- 
isters on the scan answer bus. This interrogation is done periodically 
(every 25 ms). The information provided by this interrogation (scan) 
is used by the spc to determine the sanity of the procon for processing 
calls and to verify the capability of procon to detect ssas faults. 
Among faults detected by periodic scanning are procon all-seems-well 
failures, Random Access Memory (ram) all-seems-well failures, 
procon clock-stopped and output register-full indications. Both active 
and standby ssas sides are monitored by the periodic scanning. The 
scan result is analyzed and is used to distinguish serious faults from 
nonserious faults, and to determine whether or not an immediate 
action is needed by the spc. 

2.3.2.3 Dead side tests. Despite the fact that extensive error 
checking circuitry has been built into the ssas hardware, the possibility 
still exists that some faults may elude the checks and not be reported 
to the spc. Potential faults in this category are nonclassical faults, 
multiple faults, certain procon and ram failures, etc. A possible 
consequence of such faults is a dead ssas side which appears to be free 
of faults during a period of no normal spc-ssas communications. To 
detect such a failure mode, the spc performs an exercise periodically. 
The exercise involves sending a command to an ssas side and receiving 
a specific reply. If an ssas side fails to reply as expected, then the side 
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is considered to be faulty, and appropriate information is reported to 
the reconfiguration program. 

Since ssas functional integrity is constantly checked by call proc- 
essing functions, the dead side test for an active ssas side will be 
skipped if traffic is present on the side. More specifically, an ssas side 
will not be tested if valid replies are coming through its output register 
at a regular interval. 

2.3.3 Reconfiguration 

2.3.3. 1 Classification of faults. The response of the ssas recon- 
figuration program to various ssas faults is based on a fault classifi- 
cation scheme which categorizes the faults according to their impact 
on the normal operation of ssas. Faults fall into one of four categories 
which can be summarized as follows: 

(i) Serious faults. This type of fault corresponds to those which 
seriously affect the call processing capability of ssas. For ex- 
ample, a fault which stops normal operation of procon is 
considered to be serious. A serious fault on an active ssas side 
will cause an immediate switch to the other side. 

(«) Nonserious faults. A nonserious fault is defined as a type which 
does not seriously affect the call-processing capability of an 
ssas side. An active side with this type of fault can continue to 
perform its normal function adequately as long as it is required 
to do so. This in turn implies that the switching action to the 
mate side can be delayed indefinitely, if necessary. For example, 
a single bit failure on the announcement data can be considered 
nonserious since its impact on the quality of the announcement 
is insignificant. As another example, a group controller failure 
on the active side can also be considered nonserious, since the 
side can continue to process calls using the remainder of the 
group controllers and their associated cdas. 

(Hi) mfb faults. This type of fault is usually an indication of a failure 
in the mfb itself or the standby ssas side, with no impact on 
the active ssas side. No switching of sides is performed in this 
case. Instead, the standby side and mfb are both diagnosed for 
isolation of faulty units. 

(iv) CD a faults. This type of failure usually represents a problem in 
an individual cda. Since there are many cdas in ssas, an 
individual cda failure does not have a serious impact on the 
call-processing capability of ssas. A faulty cda is marked out 
of service and will not be used until it is diagnosed and repaired. 

2.3.3.2 Smooth side switch. The process of interchanging the 
active side and standby side is referred to as a side switch. If this is 
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done so that the flow of announcements is not interrupted, the switch 
is called a smooth switch. 

A smooth switch between two ssas sides is performed under two 
circumstances. One case is when the active side has a nonserious fault 
such as single bit failure in announcement data. In this case, the 
system can afford to wait as long as needed to switch smoothly. The 
other situation is when a routine switch to the standby side is desired 
to test the hardware controlling the reconfiguration and to provide a 
chance to run a routine set of diagnostics on the previously active side. 
This process (the smooth switch exercise) is performed three times a 
day. 

A smooth switch is typically characterized by the following actions. 
First, the spc sends a command to the active side, telling it to go 
standby gracefully. Second, the active side brings the standby side in 
loose synch with the active. Third, the standby side is told to go active 
gracefully. Since by now the active and the standby are loosely in 
synch, both sides time themselves until the right moment when the 
old active goes standby followed almost immediately by the old 
standby going active. The new active verifies its success by sending a 
reply to the spc. Upon receipt of this reply, the spc changes the ssas 
status words to record the new configuration. This type of side switch 
does not provide any discontinuity in the announcement heard by the 
customer and also has no effect on the call processing operation. 

2.3.3.3 Other types of side switch. The handshaking between the 
two sides required to perform a smooth switch may not be possible if 
the active side develops a serious fault such as a procon all-seems- 
well failure. Assuming that the nonactive side is in the standby ready 
state, the spc simply takes the faulty side out of service and makes the 
standby side active. This type of switch is referred to as an immediate 
switch. Since the standby's data ram is up to date with the active side, 
only a minor disruption to call processing results. The announcement 
heard by a customer is interrupted. Approximately a half-second 
elapses, and then the entire announcement is repeated. In addition, it 
may result in mishandling a single call. However, this minor disruption 
of the call processing is considered a small penalty, as hardware faults 
occur rarely. 

Another type of side switch, called a rough switch, happens when 
the active side is doing call processing and the nonactive side is running 
a routine diagnostic on itself. If the active side develops a serious fault, 
it is immediately taken out of service. In the meantime, the routine 
diagnostic on the nonactive side is aborted, and the side is made active. 
Since the data ram on the standby side is not up-to-date while a 
diagnostic is being run, it will be initialized before becoming active. 
Therefore, all processing on existing calls is aborted and the ssas starts 
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afresh. Considering the reliability objectives of the ssas, the probabil- 
ity of occurrence of a rough switch is estimated to be very small. 

2.3.3.4 Tolerance of software errors. Software errors are usually 
analogous to a serious component failure, causing both ssas sides to 
go down and remain down until the problem has been rectified. 
However, certain classes of software errors could be considered toler- 
able. An erroneous software instruction which is executed infrequently, 
if it is considered to be nontolerable, could cause a permanent outage 
of the ssas upon its first execution. On the other hand, if at this time 
the ssas is reinitialized and restarted, it will continue to perform its 
normal function until some later time, when it will encounter its second 
failure, due to the execution of the erroneous software instruction. 
Following this strategy would substantially decrease the ssas down- 
time in cases where infrequently executed software errors are present. 

The above considerations provided the basis for developing a strat- 
egy which tolerates certain classes of errors in the procon software. 
Upon occurrence of an ssas outage, the spc performs an analysis for 
both sides using past history of ssas outages. First the side with the 
fewer past failures is selected. Then after the analysis a decision is 
made on the nature of the problem for that side, as to whether a 
hardware fault or a software error exists. In the latter case, the side is 
reinitialized and used for call processing after a successful initialization, 
while a diagnostic is requested for its mate side. In the former case, 
both SSAS sides are diagnosed to pinpoint the hardware malfunctions. 

2.3.3.5 Duplex failure. If ssas becomes totally unavailable, the 
call processing function performed by the ssas is aborted and all new 
calls will be routed to the operators. The new calls are blocked from 
attempting to cease cdas for service. Also, several clean-up actions are 
performed by the spc to allow for rapid restoration of acts. For 
example the peripheral orders waiting to be sent to the ssas are 
searched and disposed of. The ssas is blocked from providing acts 
until all the clean-up tasks are completed. 

2.4 SSAS diagnostics 

2.4. 1 Controller diagnostic 

2.4. 1. 1 Interface SPC — PROCON. The ssas diagnostic programs 
run on one ssas side at a time, always a nonactive side. The diagnostic 
request is made either by manual request or by fault recognition 
programs, either as a result of a fault being detected or as a routine 
diagnostic. The routine diagnostic is run once a day to do a complete 
check of the ssas hardware. 

As a direct consequence of the ssas architecture, the ssas diagnostic 
control is divided into two parts; the first part resides in spc, and the 
second resides in procon's Read Only Memory (rom) and is under 
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the control of a standby monitor program which controls the various 
activities of a nonactive ssas side, including diagnostics. Other activi- 
ties associated with the standby monitor include fault recognition, 
unloading of the Mate Frame Buffer (mfb) and other spc-requested 
nondiagnostic functions, spc retains the overall control over the ssas 
diagnostic, spc initiates ssas diagnostics by first marking the ssas side 
out of service and then sending a diagnostic request to the procon. 
The request indicates that a group of tests referred to as a "phase" is 
to be run by procon. In some cases, this request is also accompanied 
by a test pattern to be used by procon. The standby monitor decodes 
the request, performs error checking, and invokes the procon diag- 
nostic control program. This program further decodes the diagnostic 
request to select the proper diagnostic phase. Once a diagnostic phase 
is initiated, the standby monitor exercises control over the execution 
of the diagnostic. A diagnostic phase performs tests on the ssas 
functional block being diagnosed, using predetermined test patterns 
and sends the test results to spc through the fifo output register. The 
test results are used by the spc to isolate the particular fault involved. 

2.4. 1.2 Levels of raw data compression. The diagnostic test re- 
sults sent by procon through the FIFO output register are compared 
against the expected result by the spc. The result of that comparison 
is saved as a binary string of ones and zeros referred to as "raw data" 
results. The zeros represent the tests passed and ones indicate the 
tests failed. Although procon does considerable data comparison, in 
many diagnostic phases the test results sent by procon are quite 
voluminous and exceed the capacity of the trouble number generation 
programs. In such cases, spc uses a compression algorithm for con- 
verting the test results into a compressed raw data bit string. The 
algorithm uses a simple procedure: If any test result word sent by 
procon does not match the expected value, the spc diagnostic program 
will map this mismatch into one raw data bit. The compressed raw 
data bit string is further reduced by the spc to a 4-part, 16-digit 
number referred to as a "fault signature," which uniquely identifies 
the string. The fault signature is used by the maintenance personnel 
to reference a trouble-locations manual to isolate the particular fault 
involved. 

In some cases, the fault signature generated by ssas diagnostic 
programs fails to provide enough information to clear the trouble 
associated with the ssas. In such cases, the maintenance personnel can 
manually request either compressed raw data or expanded raw data. 
The raw data printout is used by maintenance personnel as an aid in 
manual troubleshooting. 

2.4.1.3 Power of PROCON test. The ssas architecture has parti- 
tioned the hardware in functional modules (such as procon, peripheral 
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control, announcement memory, service circuit group controllers, 
etc.) 5 Each of these functional modules are further partitioned to 
attain the desired level of maintainability and diagnostic resolution. 

procon access to each functional module results in a simple diag- 
nostic structure consisting of segments that diagnose only one func- 
tional module. In general, diagnostic resolution is directly related to 
the size of the module's diagnostic. Resolution can be improved by 
reducing the size of the module. A further improvement can be realized 
by choosing a diagnostic structure that begins with the diagnosis of 
the most basic functional module and proceeds to test each module by 
adding diagnostic segments that use the diagnosed modules. These 
considerations have been taken into account in planning the ssas 
diagnostic structure, which provides an average diagnostic resolution 
of three or fewer circuit packs, with the capability of detecting greater 
than 90 percent of potential ssas faults. These diagnostic objectives 
are required to limit the average repair time to about 2 hours as 
specified by the ssas maintainability objectives, procon access capa- 
bility combined with the modular architecture allows the ssas diag- 
nostic objectives to be achieved. 

Another feature that helps to achieve the ssas diagnostic resolution 
objective is the bit-sliced architecture used in designing ssas input and 
output bus interfaces. The bit-sliced architecture is used to aid the 
ssas diagnostics in pinpointing faulty packs and to reduce the number 
of board codes. This means that the common bits for all registers on 
a bus are grouped together on one or a few circuit packs (i.e., bit i for 
all registers on the bus are grouped together). Because of this archi- 
tecture, it is only necessary for the ssas diagnostic to know which bit 
is bad to isolate the faulty circuit boards. 

2.4.2 CDA diagnostic 

2.4.2. 1 SPC-PROCON interaction. The cda diagnostic is initiated 
by the spc either as a result of cda failures detected by fault recognition 
programs, error analysis programs, or a manual diagnostic request via 
the maintenance teletypewriter channel. Also, an automatic progres- 
sion test of the cdas is performed to ensure that each cda is diagnosed 
once a day. 

A service circuit known as the cda test circuit is used to diagnose 
cdas. It has network appearances so it can be connected to the various 
cda ports for analog circuit tests. 6 When a cda diagnostic is requested, 
the spc attempts to establish a test configuration if the requested cda 
is available for testing. It first verifies that the cda test circuit is 
available and the nonactive ssas side is in the standby ready state. If 
not, the diagnostic is blocked; otherwise, the cda test circuit is made 
maintenance busy, and orders are sent to the active ssas side to switch 
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both the cda test circuit and the cda under test over to the standby 
ssas side. Next, the Signal Distributor (sd) controlled relays in both 
the cda and cda test circuits are released without regard to their 
previous states, and the two circuits are connected via the tsps 
network. 

Once the test configuration is established, various phases of the cda 
diagnostic are initiated by the spc. For each phase, the spc first 
operates the required SD-controlled relays, and then sends an order to 
the standby ssas side to run tests of the specified phase. 

The procon standby monitor program processes the diagnostic 
order and transfers procon control to the cda diagnostic program. 
This program performs the tests of the specified phase and sends the 
results to the spc via the fifo output register. Once the procon reply 
is received, the spc compares the test results with the expected results. 
The result of this comparison is the diagnostic raw data. Each bit set 
to a one in the raw data represents a test failure. The raw data is then 
converted into a trouble number which is used by the maintenance 
personnel to isolate the trouble. 

When all the phases of the cda diagnostic have been completed, the 
spc releases the relays of the cda and cda test circuits, breaks the 
network connection between them, and sends orders to the standby 
ssas side to switch them back to the active side. The cda test circuit 
is returned to the maintenance idle state, and the cda under test is 
either returned to service or placed out of service, depending upon 
whether the diagnostic tests have been passed or failed. 

2.4.2.2 CDA test circuit use. The cda test circuit is a special type 
of ssAS-controlled service circuit. There is one cda test circuit per 
ssas, and it is always equipped as circuit 15 of the service circuit 
frame 1. 

The primary functions of the cda test circuit can be summarized as 
follows: 

(i) It produces simulated coin deposit signals for testing a cda coin 

tone receiver. 
(ii) It detects test tones produced by a cda announcement decoder. 

The cda test circuit architecture is quite similar to that of the other 
ssas service circuits. It consists basically of digital circuitry to interface 
with ssas, a tone generator and a tone detector (see Fig. 12). Its digital 
interface circuitry with ssas consists of command decoding logic, reply 
registers, and control logic which provides additional decoding of cda 
test circuit commands, and also controls the miniature relays which 
provide switching of pads and filters. 

The tone generator consists of an announcement decoder, an inter- 
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rupter switch, and a set of switchable attenuation pads. The interrupter 
switch is used to clamp the analog output of the announcement 
decoder to ground, thereby silencing the tone generator. The switch- 
able pads provide the level variation needed for a cda coin tone 
receiver testing. 

The tone detector consists of a switchable pad circuit, level detectors, 
and a switchable filter circuit. The switchable pad circuit provides 
level adjustment for signals generated by a cda announcement de- 
coder. The output of the announcement decoder of a cda circuit is 
tested by the level detectors for both signal loss and distortion. During 
the process of checking for signal distortion, the switchable filter 
circuit is used to remove the expected fundamental frequency com- 
ponent of the announcement decoder test tone without attenuating 
any harmonic frequency components. 

2.4.3 Use of test tones from announcement store 

Many tests performed during the course of cda diagnostic are aimed 
at detecting possible malfunctions in either the announcement decoder 
or the coin tone receiver associated with the cda under test. Proper 
operation of the announcement decoder is verified by monitoring its 
response to a set of digitized test tones. This response is checked for 
possible abnormalities in both frequency response and output level 
using a tone detector associated with the cda test circuit. The coin 
receiver is tested by using the tone announcement decoder of the cda 
test circuit to produce coin deposit signals from data stored in the ssas 
announcement memory, and checking the response of the coin tone 
receiver to deposit signals having various level, frequency, and timing 
characteristics. 

The test tones required for checking the proper operation of the 
announcement decoder and the coin tone receiver are stored as an- 
nouncement data. A total of 18 test tones are required for cda diag- 
nostic tests. The storage requirement for many of these tones is 
significantly reduced by packing several of them into a single an- 
nouncement phrase. Combining up to four 125-ms test tones into a 
single segment reduces the number of the required segments to six. 
One hundred twenty-five milliseconds allows ample time for the an- 
nouncement decoder output to stabilize and for the cda test circuit 
tone detector to achieve a stable measurement. However, this ap- 
proach adds additional timing functions for the standby procon to 
perform, procon must determine the appropriate time to strobe the 
tone detector and, for some tests, it must blank out the unwanted 
tones by operating an interrupter switch within the cda test circuit 
which turns off the analog output of the tone announcement decoder. 
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2.5 CD A alignment and manual tests 
2.5. 1 Trunk test panel connections 

The tsps Control, Display, and Test (cdt) panel provides a means 
of manually initiating tests on trunks, operator positions, and service 
circuits appearing on the tsps switching network. 6 In conjunction with 
the acts feature, provisions have been made for testing both the cda 
and the cda test circuits from the cdt panel. 

Most cda circuit tests originating from the cdt panel require that 
test connections be established between the cda circuit and the cdt 
circuit. Operation of the Master Test Line-Test key on the cdt panel 
causes the spc to connect an mf receiver to the Position Master Test 
Line (pmtl) of the cdt circuit via the tsps network. Once this connec- 
tion is established, the SPC lights the Master Test Line (mtl) lamp on 
the cdt panel, indicating that codes can be entered via the cdt 
multifrequency (mf) key set. At this point, a test connection can be 
requested with any cda circuit appearing on the tsps network by 
entering its trunk group and member number and the camp-on bit via 
the cdt mf key set. A special display on the cdt panel indicates to the 
maintenance personnel whether the request was successful, aborted 
due to system failure, or invalid. 

The spc indicates the status of the requested cda on a special 
display lamp. This lamp indicates whether the cda is idle, traffic busy, 
maintenance busy, or out of service. If the cda is busy and camp-on is 
requested, the spc reserves it for maintenance by placing it out of 
service as soon as it becomes idle and notifies the maintenance person- 
nel of its availability via a teletypewriter output message. If the cda is 
idle or out of service, the spc disconnects the mf receiver from the 
pmtl, extinguishes the mtl lamp, and establishes the test connection 
between the cda and cdt circuits. 

Several other test features involving cdt panel key actions have also 
been provided for cda circuits. By operating appropriate keys, the 
maintenance personnel can place the cda connected to the cdt out of 
service, or return it to service. Also, a display of the ferrod states of 
the cda under test can be requested by operating a special key. This 
key action causes the scan row containing the cda ferrods to be 
displayed on the program display of the control and display panel. 

2.5.2 Trunk test panel measurements 

The cda circuits contain analog transmission components which 
provide a part of the talking path between the customer or customers 
and the cda announcement decoder. These cda circuit voice paths 
must be tested with respect to noise and signal loss whenever trans- 
mission problems associated with the circuit are suspected. The trunk 
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test panel, shown in Fig. 13, provides a convenient means of performing 

noise and loss tests on cda circuits that appear on the TSPS network. 

Testing of the transmission path of a cda circuit involves separate 

tests for performing noise and loss measurements. First, a test connec- 
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Fig. 13— Trunk test panel. 
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tion is established and the Master Test Line-Test key is operated to 
signal the spc to connect an mf receiver to the pmtl. Next, by entering 
an appropriate test code and appropriate test control key actions, each 
of these tests can be initiated. These tests can be repeated or performed 
in any sequence as long as only one test control key is operated at a 
time. These tests can also be sequenced under the spc control by using 
an appropriate test code. As soon as the code is entered, the spc 
establishes the connection for the first test. Upon completion of the 
first test, the connection for the second test is established. This process 
is continued until the completion of the last test. At this point, the 
cda circuit is disconnected from the cdt panel and is returned to its 
previous state. 

Manual transmission tests of all cda circuits in the office can be 
initiated by entering a special test code. The spc connects each cda 
circuit in sequence to the cdt panel. If the circuit is traffic or mainte- 
nance busy, it is skipped and a teletypewriter message is printed. After 
the completion of the tests, the spc disconnects the cda circuit from 
the cdt and connects the next one. 

Automatic sequencing of the transmission tests of all cda circuits 
can be initiated by entering another special code. The spc connects 
each available cda circuit to the cdt panel, and sequences through 
each of the tests. Once all of the tests for a cda circuit are complete, 
another cda circuit is connected. Busy circuits which are skipped are 
identified by teletypewriter messages. 

2.5.3 Vocabulary recital 

Because the announcement decoding aspect of the ssas has no 
existing counterpart in the tsps, a totally new test feature is provided 
from the cdt panel. This feature is an announcement vocabulary 
recital exercise whereby the maintenance personnel can listen to each 
speech segment in the announcement vocabulary via the CDT telephone 
head set. 

Listening to the announcement output of a cda circuit provides a 
manual check not only of the cda circuit announcement decoder, but 
also of the ssas announcement subsystem circuits. When an announce- 
ment store is loaded from tape, this feature can be used to verify the 
contents of the store before it is made active. The announcement 
recital test can be performed from both active and standby ssas sides. 
Two options are provided for the recital test. They can be summarized 
as follows: 

(i) The decoding of every announcement segment and phrase in 

sequence. 
(«') The repetitive decoding of a specified announcement segment 
or phrase. 
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The announcement recital test on an active ssas side begins with a 
cda circuit connected to the cdt panel. By operating appropriate keys 
and entering a special test code, the spc starts the PROCON-controlled 
announcement exercise on the active side. This exercise accesses the 
announcement data for a phrase and sends it to the cda circuit under 
test. It sequences through every word or phrase in the announcement 
vocabulary and then stops. Each word or phrase is separated by x h 
second of silence. 

Entering another test code causes a specified announcement phrase 
to be repeated at a constant rate. This is controlled by another procon 
exercise which accesses the announcement data for the specified 
phrase and sends it to the cda circuit under the test. One-half second 
of silence is inserted between repetitions. The phrase is repeated until 
the circuit is released from the cdt panel. 

Similar procedures are used for the announcement recital test from 
a standby ssas side. Again by entering special codes, appropriate 
announcement exercises are started. If the ssas diagnostic is in prog- 
ress on the standby side, the exercise is not run and a teletypewriter 
output message is printed. 
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